diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2016-11-30 03:07:37 +0000 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2016-11-30 19:44:24 +1100 |
| commit | 786d5994da79151180cb14a6cf157ebbba61c0cc (patch) | |
| tree | 706aea69bf1507b0dca261fbc15739b2f24587a8 /ssh-agent.1 | |
| parent | 7844f357cdd90530eec81340847783f1f1da010b (diff) | |
upstream commit
add a whitelist of paths from which ssh-agent will load
(via ssh-pkcs11-helper) a PKCS#11 module; ok markus@
Upstream-ID: fe79769469d9cd6d26fe0dc15751b83ef2a06e8f
Diffstat (limited to 'ssh-agent.1')
| -rw-r--r-- | ssh-agent.1 | 17 |
1 files changed, 15 insertions, 2 deletions
diff --git a/ssh-agent.1 b/ssh-agent.1 index c4b50bbd..372adbe7 100644 --- a/ssh-agent.1 +++ b/ssh-agent.1 @@ -1,4 +1,4 @@ -.\" $OpenBSD: ssh-agent.1,v 1.62 2015/11/15 23:54:15 jmc Exp $ +.\" $OpenBSD: ssh-agent.1,v 1.63 2016/11/30 03:07:37 djm Exp $ .\" .\" Author: Tatu Ylonen <ylo@cs.hut.fi> .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -34,7 +34,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd $Mdocdate: November 15 2015 $ +.Dd $Mdocdate: November 30 2016 $ .Dt SSH-AGENT 1 .Os .Sh NAME @@ -47,6 +47,7 @@ .Op Fl a Ar bind_address .Op Fl E Ar fingerprint_hash .Op Fl t Ar life +.Op Fl P Ar pkcs11_whitelist .Op Ar command Op Ar arg ... .Nm ssh-agent .Op Fl c | s @@ -121,6 +122,18 @@ The default is Kill the current agent (given by the .Ev SSH_AGENT_PID environment variable). +.It Fl P +Specify a pattern-list of acceptable paths for PKCS#11 shared libraries +that may be added using the +.Fl s +option to +.Xr ssh-add 1 . +The default is to allow loading PKCS#11 libraries from +.Dq /usr/lib/*,/usr/local/lib/* . +PKCS#11 libraries that do not match the whitelist will be refused. +See PATTERNS in +.Xr ssh_config 5 +for a description of pattern-list syntax. .It Fl s Generate Bourne shell commands on .Dv stdout . |